CVE-2026-40486 Details
Description
Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies submitted preference values without checking the isEnabled() flag on preference objects. Although the hourly_rate and internal_rate fields are correctly marked as disabled for users lacking the hourly-rate role permission, the API ignores this restriction and saves the values directly. Any authenticated user can modify their own billing rates through this endpoint, resulting in unauthorized financial tampering affecting invoices and timesheet calculations. This issue has been fixed in version 2.53.0.
A vulnerability in the Kimai User Preferences API endpoint allows authenticated users to arbitrarily modify restricted financial attributes, specifically the 'hourly_rate' and 'internal_rate' fields. This issue affects Kimai versions through 2.52.0. The vulnerability arises because the API endpoint applies submitted preference values without verifying the 'isEnabled()' flag on preference objects. Although the 'hourly_rate' and 'internal_rate' fields are correctly disabled for users without the 'hourly-rate' role permission, the API ignores this restriction, allowing unauthorized modifications. As a result, any authenticated user can tamper with their billing rates, leading to unauthorized changes in invoices and timesheet calculations.
Users can update to Kimai version 2.53.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kimai/kimai/releases/tag/2.53.0 | [email protected] | ProductRelease Notes |
| https://github.com/kimai/kimai/security/advisories/GHSA-qh43-xrjm-4ggp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kimai kimai | < 2.53.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |